The role of extra-role behaviors and social controls in information security policy effectiveness

doi:10.1287/isre.2015.0569

機構典藏 > College of Business and Management > Graduate Institute & Department of Information Management > Journal Article > Item 987654321/107126

Please use this identifier to cite or link to this item: https://tkuir.lib.tku.edu.tw/dspace/handle/987654321/107126

Title:	The role of extra-role behaviors and social controls in information security policy effectiveness
Authors:	Jack Shih-Chieh Hsu;Shih, Sheng-Pao;Hung, Yu Wen;Lowry, Paul Benjamin
Keywords:	IS security;behavioral security;in-role behaviors;extra-role behaviors;social control theory;SCT;security management;information security policy;ISP;formal control;social control;organizations
Date:	2015-06-19
Issue Date:	2016-08-17 09:11:01 (UTC+8)
Publisher:	Information Systems Research
Abstract:	Although most behavioral security studies focus on organizational in-role behaviors such as information security policy (ISP) compliance, the role of organizational extra-role behaviors—security behaviors that benefit organizations but are not specified in ISPs—has long been overlooked. This study examines (1) the consequences of organizational in-role and extra-role security behaviors on the effectiveness of ISPs and (2) the role of formal and social controls in enhancing in-role and extra-role security behaviors in organizations. We propose that both in-role security behaviors and extra-role security behaviors contribute to ISP effectiveness. Furthermore, based on social control theory, we hypothesize that social control can boost both in- and extra-role security behaviors. Data collected from practitioners—including information systems (IS) managers and employees at many organizations—confirmed most of our hypotheses. Survey data from IS managers substantiated the importance of extra-role behaviors in improving ISP effectiveness. Paired data, collected from managers and employees in the same organizations, indicated that formal control and social control individually and interactively enhance both in- and extra-role security behaviors. We conclude by discussing the implications of this research for academics and practitioners, along with compelling future research possibilities.
Relation:	Information Systems Research 26(2), p.243-472
DOI:	10.1287/isre.2015.0569
Appears in Collections:	[Graduate Institute & Department of Information Management] Journal Article

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	294	View/Open
The Role of Extra-Role Behaviors and Social Controls in Information Security Policy Effectiveness.pdf		297Kb	Adobe PDF	1	View/Open

Loading...